The constructs in a C++
program create, destroy, refer to, access, and manipulate objects.
An object is created by a definition (3.1), by a new-expression (5.3.4)
or by the implementation (12.2) when needed.
An object isobject occupies a region of storage throughout its lifetime (3.8 basic.life).
[ Note:
A function is not an object, regardless of whether or not it occupies storage in the
way that objects do.
— end note ]
An object is created by a definition (3.1), by a new-expression (5.3.4)
or by the implementation (12.2) when needed.
[…]

Drafting note: this maintains the status quo that malloc alone is
not sufficient to create an object.

Change in 1.8 (intro.object) paragraph 6:

Unless an object is a bit-field or a base class subobject of zero size,
the address of that object is the address of the first byte it occupies.
Two objects with overlapping lifetimes that are not bit-fields
may have the same address if one is a subobject of the other,
or if at least one is a base class subobject of zero size and they are of different types;
otherwise, they shall have distinct addresses. [Footnote: …] [Example: …]

Add a new paragraph after 3.7 (basic.stc) paragraph 3:

When the end of the duration of a region of storage is reached,
the values of all pointers representing the address of
any part of the deallocated storage
become invalid pointer values ([basic.compound]).
Indirection through
an invalid pointer value and passing an invalid pointer value to a deallocation
function have undefined behavior. Any other use of an invalid pointer value has
implementation-defined behavior.
[ Footnote:
Some implementations might define that copying an invalid pointer value causes
a system-generated runtime fault.
— end footnote ]

Drafting note: this should apply to all storage durations that can end,
not just to dynamic storage duration. On an implementation supporting threads
or segmented stacks, thread and automatic storage may behave in the same
way that dynamic storage does.

Change in 3.7.4.1 (basic.stc.dynamic.allocation) paragraph 2:

[…]
Furthermore, for the library allocation functions in 18.6.1.1 and
18.6.1.2, p0 shall point torepresent the address of
a block of storage disjoint from the storage for
any other object accessible to the caller. The effect of indirecting through a
pointer returned as a request for zero size is undefined.

Change in 3.7.4.1 (basic.stc.dynamic.allocation) paragraph 2:

If the argument given to a deallocation function in the standard library is a
pointer that is not the null pointer value (4.10), the deallocation function
shall deallocate the storage referenced by the pointer,
ending the duration of the region of storage.
rendering invalid all
pointers referring to any part of the deallocated storage. Indirection through
an invalid pointer value and passing an invalid pointer value to a deallocation
function have undefined behavior. Any other use of an invalid pointer value has
implementation-defined behavior.
[ Footnote:
Some implementations might define that copying an invalid pointer value causes
a system-generated runtime fault.
— end footnote ]

Change in 3.8 (basic.life) paragraph 5:

Before the lifetime of an object has started but after the storage which the object will occupy has been allocated [Footnote: …] or,
after the lifetime of an object has ended and before the storage which the object occupied is reused or released,
any pointer that refers torepresents the address of the storage location
where the object will be or was located may be used but only in limited ways.
[…]

Change in 3.8 (basic.life) paragraph 9:

Creating a new object at the storage location that a constcomplete object with static,or thread, or automatic storage
duration occupies or, at the storage location that such a const object used to occupy before its lifetime
ended results in undefined behavior. [Example: …]

This is necessary to allow types such as std::optional to contain const subobjects; the existing restriction exists to allow ROMability, and so only affects complete objects and is not necessary for automatic storage duration objects.

Change in 3.9.2 (basic.compound) paragraph 3:

[…]
A value of an object pointer type cvT* either:

points to an object or function, or

points past the end of an object (5.3.1 expr.unary.op), or

is the null pointer value (4.10 conv.ptr) for that type, or

is an invalid pointer value.

A valid value of an object pointer type that points to or past the end of an objectrepresents either
the addressrepresents the address
of athe first byte in memory (1.7 intro.memory)
that the object occupiesor a null pointer (4.10).
If an object of type T is located at an address A, a pointer of type cv T* whose value is the
address A is said to point to that object, regardless of how the value was obtained.
[ Note:
For instance, the address oneA pointer past the
end of an arrayobject (5.7)
would beis not
considered to point to an unrelated object of the
array's elementobject's type
that might be located at that address.
There are further restrictions on pointers to
objects with dynamic storage duration; see 3.7.4.3.
A pointer acquires an invalid pointer value
when the storage it denotes
reaches the end of its storage duration; see [basic.stc].
— end note ]
For purposes of pointer arithmetic (5.7 expr.add) and comparison (5.9 expr.rel, 5.10 expr.eq),
a pointer that points past the end of the last element of an array of n elements is considered
to point to a hypothetical element n.
The value representation of pointer types is implementation-defined.
Pointers to cv-qualified and cv-unqualified versions (3.9.3)
of layout-compatible types
shall have the same value representation and alignment requirements (3.11).
[ Note: … — end note ]

Change in 5.7 (expr.add) paragraph 4:

When an expression that has integral type is added to or subtracted from a pointer,
the result has the type of the pointer operand.
If the pointer operand points to an element of an array object [Footnote],
and the array is large enough,
the result points to an element offset from the original element
such that the difference of the subscripts
of the resulting and original array elements
equals the integral expression.
In other words, if
If
the expression P
points to the i-th element i
of an array object with n elements
[ Footnote:
An object that is not an array element is considered to belong to a single-element array for this purpose; see 5.3.1.
A pointer past the end of the last element of an array of n elements
is considered to point to a hypothetical element n for this purpose; see 3.9.2.
],
the expressions
(P)+N (equivalently, N+(P)) and (P)-NP + J and J + P
(where NJ has the value nj)
point to, respectively, theelementi + j-th and i - n-th elements
of the array object
, provided they existif 0 ≤ i + j < n,
and point past the last element of the array object if i + j = n
Moreover, if the expression P points to the last element of an array object,
the expression (P)+1 points one past the last element of the array object, and if the expression Q points
one past the last element of an array object, the expression (Q)-1 points to the last element of the array
object. If both the pointer operand and the result point to elements of the same array object, or one past
the last element of the array object, the evaluation shall not produce an overflow; otherwise, the behavior is
undefined.
Likewise, the expression P - J points to element i - j of the array object
if 0 ≤ i - j < n,
and point past the last element of the array object if i - j = n; otherwise, the behavior is undefined.

Change in 5.7 (expr.add) paragraph 5:

When two pointers to elements of the same array object are subtracted,
the result is the difference of the subscripts of the two array elements.
Thethe
type of the result is an implementation-defined signed integral type;
this type shall be the same type that is defined as std::ptrdiff_t in the <cstddef> header (18.2).
As with any other arithmetic overflow, if the result does not fit in the space provided, the behavior is undefined.
In other words, if
If
the expressions P and Q point to, respectively,
the i-th and j-th elements i and j of anthe same array object,
the expression (P)-(Q)P - Q has the value i - jprovided the value fits in an object of type std::ptrdiff_t.; otherwise, the behavior is undefined.
[ Note:
If the value i - j is not in the range of representable values of type std::ptrdiff_t, the behavior is undefined.
— end note ]
Moreover, if the expression P points either to an element of an array object or one past the last element of
an array object, and the expression Q points to the last element of the same array object, the expression
((Q)+1)-(P) has the same value as ((Q)-(P))+1 and as -((P)-((Q)+1)), and has the value zero if the
expression P points one past the last element of the array object, even though the expression (Q)+1 does not
point to an element of the array object. Unless both pointers point to elements of the same array object, or
one past the last element of the array object, the behavior is undefined.
[Footnote: Another way to approach pointer arithmetic …]

Change in 5.7 (expr.add) paragraph 7:

If the value 0 is added to or subtracted from a null pointer value, the result compares equal to the original pointer
valueis a null pointer value.
If two pointers point to the same object or both point past the end of the same array or both
are null, and the two pointer values are subtracted, the result compares equal to the value 0 converted to the type
std::ptrdiff_t.

Change in 5.9 (expr.rel) paragraph 3:

Comparing unequal pointers to objects
[ Footnote:
An object that is not an array element is considered to belong to a single-element array for this purpose; see 5.3.1.
A pointer past the end of the last element of an array of n elements
is considered to point to a hypothetical element n for this purpose; see 3.9.2.
]
is defined as follows:

If two pointers point to different elements of the same array, or to subobjects thereof, the pointer to
the element with the higher subscript compares greater.

If one pointer points to an element of an array, or to a subobject thereof, and another pointer points
one past the last element of the array, the latter pointer compares greater.

If two pointers point to different non-static data members of the same object, or to subobjects of such
members, recursively, the pointer to the later declared member compares greater provided the two
members have the same access control (Clause 11) and provided their class is not a union.

Drafting note: the change in 3.9.2 affects the semantics of an example like:

Prior to this change, the result of the comparison was unspecified; now, it is required to hold, because &s.a + 1 is treated as a pointer to an element of the "array" s.a. The value of &s.b > &s.a + 1 is now specified and is false if and only if the pointers represent the same address.

Change in 9.2 class.mem paragraph 19:

If a standard-layout class object
has any non-static data members,
its
address is the same as the address of
its first non-static data member.
Otherwise,
its
address is the same as the address of
its first base class subobject (if any).
[ Note …—end note ]
[ Note
Nonetheless, if a pointer to the object
is cast to a pointer to
the type of its first subobject (or vice versa),
the resulting pointer does not point to the
subobject and can not be used to access it.
—end note ]

Change in 9.5 class.union paragraph 1, splitting it into two paragraphs:

In a union,
a non-static data member is active
if its name refers to an object
whose lifetime has begun and has not ended ([basic.life]).atAt most one of the non-static data members
of an object of union type
can be active at any
time, that is, the value of at most one of the non-static data members can be
stored in a union at any time.
[ Note:
One special guarantee is made in order
to simplify the use of unions:
If a standard-layout union contains several
standard-layout structs that share a common initial sequence (9.2),
and if the active member of an object
of this standard-layout union type
containsis one of the standard-layout structs,
it is permitted to inspect the common initial sequence of any of the
standard-layout struct members; see 9.2.
— end note ]

The size of a union is sufficient to contain the largest of its non-static data members.
Each non-static data member is allocated as if it were the sole member of a struct.
All non-static data members of a union object have the same address.
[ Note
Nonetheless, if a pointer to a union object
is cast to a pointer to
the type of a non-static data member (or vice versa),
the resulting pointer does not point to the
subobject and can not be used to access it.
—end note ]

Drafting note: see N4303 for more background on the purpose and intended usage of this function.

Change in 20.7.5 (ptr.align) paragraph 1:

Effects:
If it is possible to fit size bytes of storage aligned by alignment into the buffer pointed to by
ptr with length space, the function updates ptr to
point torepresent the first possible
address of such storage and decreases space by the number of bytes
used for alignment.

Change in 20.7.5 (ptr.align) paragraph 2:

Requires:

alignment shall be a power of two

ptr shall point torepresent the address of contiguous storage of at least space bytes